[PATCH] Change the max number of active probe SSIDs to match registration

[PATCH] Change the max number of active probe SSIDs to match registration

[Alex David]

The maximum number of SSIDs in a for active probe requests is currently
reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver.
The scan_req_params structure only has the capacity to hold 10 SSIDs.
This leads to a buffer overflow which can be triggered from wpa_supplicant
in userspace. When copying the SSIDs into the scan_req_params structure in
the ath11k_mac_op_hw_scan route, it can overwrite the extraie pointer.

Signed-off-by: Alex David <flu0r1ne@flu0r1ne.net>
---
 drivers/net/wireless/ath/ath11k/wmi.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
index 0584e68e7593..86bed27e90d8 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.h
+++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -3077,8 +3077,8 @@ enum scan_dwelltime_adaptive_mode {
 	SCAN_DWELL_MODE_STATIC = 4
 };

-#define WLAN_SCAN_MAX_NUM_SSID          10
-#define WLAN_SCAN_MAX_NUM_BSSID         10
+#define WLAN_SCAN_MAX_NUM_SSID          16
+#define WLAN_SCAN_MAX_NUM_BSSID         4
 #define WLAN_SCAN_MAX_NUM_CHANNELS      40

 #define WLAN_SSID_MAX_LEN 32
--
2.34.1



-- 
ath11k mailing list
ath11k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath11k

Re: [PATCH] Change the max number of active probe SSIDs to match registration

[Kalle Valo]

Alex David <flu0r1ne@flu0r1ne.net> writes:

> The maximum number of SSIDs in a for active probe requests is currently
> reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver.
> The scan_req_params structure only has the capacity to hold 10 SSIDs.
> This leads to a buffer overflow which can be triggered from wpa_supplicant
> in userspace. When copying the SSIDs into the scan_req_params structure in
> the ath11k_mac_op_hw_scan route, it can overwrite the extraie pointer.
>
> Signed-off-by: Alex David <flu0r1ne@flu0r1ne.net>

I missed this as this wasn't in patchwork. This is because you didn't CC
linux-wireless. Please see instructions here how to submit ath11k
patches:

https://wireless.wiki.kernel.org/en/users/drivers/ath11k/submittingpatches

Please also add "ath11k:" prefix to the subject and a Tested-on tag.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

-- 
ath11k mailing list
ath11k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath11k